Finnish Court Upholds Cookie Consent Violation Against Sanoma Media

Sanoma Media Finland Oy was found to have deployed cookies and web request tracking on its websites without obtaining valid user consent, violating the ePrivacy Directive as implemented in Finnish law. The court rejected broad interpretations of the 'strictly necessary' cookie exemption, reinforcing that consent cannot be bypassed through technical workarounds or vague necessity claims. This ruling underscores that non-compliance with cookie consent requirements carries serious legal consequences, even for well-established media companies. Organizations must treat web tracking technologies as a data governance issue requiring formal consent frameworks, not merely a technical or UX consideration.

Tactical Insight

Immediate actions

Conduct a full audit of all cookies, pixels, and web request tracking technologies deployed across company websites to identify those lacking valid consent.
Disable or block any non-essential tracking technologies until a compliant consent mechanism is in place.

Compliance & governance improvements

Implement a legally reviewed Consent Management Platform (CMP) that captures, stores, and enforces granular user consent before any non-essential cookies or trackers fire.
Adopt a narrow, legally defensible definition of 'strictly necessary' cookies, documented with evidence, to avoid over-reliance on the necessity exemption.
Establish a recurring legal review process (at least annually) to ensure cookie practices remain aligned with evolving ePrivacy and GDPR regulatory guidance.

Detection & accountability measures

Deploy automated cookie scanning tools to continuously monitor websites for undeclared or newly introduced tracking technologies.
Assign a designated Data Protection Officer (DPO) or privacy lead with authority to approve and document all tracking technology deployments before launch.